1 数据结构
struct binder_state
{
    int fd;
    void *mapped;
    unsigned mapsize;
};

struct binder_object
{
    uint32_t type;
    uint32_t flags;
    void *pointer;
    void *cookie;
};

struct binder_txn
{
    void *target;
    void *cookie;
    uint32_t code;
    uint32_t flags;

    uint32_t sender_pid;
    uint32_t sender_euid;

    uint32_t data_size;
    uint32_t offs_size;
    void *data;
    void *offs;
};

struct binder_io
{
    char *data;            /* pointer to read/write from */
    uint32_t *offs;        /* array of offsets */
    uint32_t data_avail;   /* bytes available in data buffer */
    uint32_t offs_avail;   /* entries available in offsets array */

    char *data0;           /* start of data buffer */
    uint32_t *offs0;       /* start of offsets buffer */
    uint32_t flags;
    uint32_t unused;
};

struct binder_death {
    void (*func)(struct binder_state *bs, void *ptr);
    void *ptr;
};

/*
 * On 64-bit platforms where user code may run in 32-bits the driver must
 * translate the buffer (and local binder) addresses apropriately.
 */
struct binder_write_read {
	signed long	write_size;	/* bytes to write */
	signed long	write_consumed;	/* bytes consumed by driver */
	unsigned long	write_buffer;
	signed long	read_size;	/* bytes to read */
	signed long	read_consumed;	/* bytes consumed by driver */
	unsigned long	read_buffer;
};

2 代码流程
int main(int argc, char **argv)
{
    struct binder_state *bs;
    void *svcmgr = BINDER_SERVICE_MANAGER;

    bs = binder_open(128*1024);

    if (binder_become_context_manager(bs)) {
        LOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }

    svcmgr_handle = svcmgr;
    binder_loop(bs, svcmgr_handler);
    return 0;
}
<1> #define BINDER_SERVICE_MANAGER ((void*) 0)，即*svcmgr句柄为0
<2> bs = binder_open(128*1024)，调用Binder驱动打开/dev/binder
		struct binder_state *binder_open(unsigned mapsize)
		{
			struct binder_state *bs;

			bs = malloc(sizeof(*bs));
			if (!bs) {
				errno = ENOMEM;
				return 0;
			}

			bs->fd = open("/dev/binder", O_RDWR);
			if (bs->fd < 0) {
				fprintf(stderr,"binder: cannot open device (%s)\n",
				        strerror(errno));
				goto fail_open;
			}

			bs->mapsize = mapsize;
			bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
			if (bs->mapped == MAP_FAILED) {
				fprintf(stderr,"binder: cannot map device (%s)\n",
				        strerror(errno));
				goto fail_map;
			}

				/* TODO: check version */

			return bs;

		fail_map:
			close(bs->fd);
		fail_open:
			free(bs);
			return 0;
		}
	由此可得，bs->mapsize = 128*1024
<3> binder_become_context_manager(bs)注册成为ServiceManager
	int binder_become_context_manager(struct binder_state *bs)
	{
		return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
	}
	调用ioctl注册成ServiceManager（具体代码需要查看Binder的驱动）
<4> svcmgr_handle = svcmgr;
    binder_loop(bs, svcmgr_handler);
    循环等待binder命令
    void binder_loop(struct binder_state *bs, binder_handler func)
	{
		int res;
		struct binder_write_read bwr;
		unsigned readbuf[32];

		bwr.write_size = 0;
		bwr.write_consumed = 0;
		bwr.write_buffer = 0;
		
		readbuf[0] = BC_ENTER_LOOPER;
		binder_write(bs, readbuf, sizeof(unsigned));

		for (;;) {
		    bwr.read_size = sizeof(readbuf);
		    bwr.read_consumed = 0;
		    bwr.read_buffer = (unsigned) readbuf;

		    res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

		    if (res < 0) {
		        LOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
		        break;
		    }

		    res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
		    if (res == 0) {
		        LOGE("binder_loop: unexpected reply?!\n");
		        break;
		    }
		    if (res < 0) {
		        LOGE("binder_loop: io error %d %s\n", res, strerror(errno));
		        break;
		    }
		}
	}
注意：
	sizeof(*bs)的大小是在编译器编译期间确定的，而不是在程序运行时计算
	
bs->fd = open("/dev/binder", O_RDWR)
"/dev/binder"文件是由Binder驱动创建的，打开"/dev/binder"会调用到Binder的驱动中的打开文件动作
SourceCode路径为drivers/staging/android/binder.c
驱动的操作方法表：
static struct file_operations binder_fops = {
	.owner = THIS_MODULE,
	.poll = binder_poll,
	.unlocked_ioctl = binder_ioctl,
	.mmap = binder_mmap,
	.open = binder_open,
	.flush = binder_flush,
	.release = binder_release,
};
打开"/dev/binder"调用drivers/staging/android/binder.c中的binder_open函数
static int binder_open(struct inode *nodp, struct file *filp)
{
	struct binder_proc *proc;

	if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE)
		printk(KERN_INFO "binder_open: %d:%d\n", current->group_leader->pid, current->pid);

	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
	if (proc == NULL)
		return -ENOMEM;
	get_task_struct(current);
	proc->tsk = current;
	INIT_LIST_HEAD(&proc->todo);
	init_waitqueue_head(&proc->wait);
	proc->default_priority = task_nice(current);
	mutex_lock(&binder_lock);
	binder_stats.obj_created[BINDER_STAT_PROC]++;
	hlist_add_head(&proc->proc_node, &binder_procs);
	proc->pid = current->group_leader->pid;
	INIT_LIST_HEAD(&proc->delivered_death);
	filp->private_data = proc;
	mutex_unlock(&binder_lock);

	if (binder_proc_dir_entry_proc) {
		char strbuf[11];
		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
		remove_proc_entry(strbuf, binder_proc_dir_entry_proc);
		create_proc_read_entry(strbuf, S_IRUGO, binder_proc_dir_entry_proc, binder_read_proc_proc, proc);
	}

	return 0;
}
kzalloc相当于先调用kmalloc分配内核空间，然后将内存全部初始化为0

